CBP Workers Allegedly Used Government Databases to Spy on Exes, Crushes, and Colleagues
CBP employees allegedly misused government databases to spy on exes, crushes, and colleagues.
Hundreds of allegations reveal that Customs and Border Protection employees and contractors abused sensitive government databases for personal reasons, including spying on romantic interests and colleagues. These abuses, spanning from 2009 to 2022, involved querying data for non-job-related purposes, such as contacting flight attendants, asking people out, and even providing border-crossing data to individuals involved in disputes. One case involved using ad-tech-derived location data to track coworkers' cell phones, marking a potential first for DHS internal abuse of such data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CBP?
Get an email when a new story names CBP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOver hundreds of documented cases spanning more than a decade, CBP employees and contractors exploited privileged access to sensitive government databases for entirely personal purposes — stalking romantic interests, tracking colleagues, and sharing border-crossing data with unauthorized parties. The root cause is a systemic failure in access control: users were granted broad query privileges without adequate justification, oversight, or accountability mechanisms. This matters because insider abuse of sensitive databases can compromise national security, violate individuals' civil liberties, and erode public trust in government institutions. The inclusion of contractors further highlights how third-party access amplifies risk when proper controls and monitoring are absent.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.